Rollback manager

Every approved job comes with a rollback plan generated before execution. If something breaks, you don't guess -- you click. Plans are persisted with the job for the lifetime of the audit window.

Rollbacks themselves go through approvals + the same execution guardrails -- they're just another job, with the diff inverted.